What should be preserved from a live messaging conversation?¶

A live messaging conversation can change through new messages, edits, deletions, reactions, read receipts and synchronisation.

Avoid this assumption: Preserving only the visible message text is enough. The evidential value often depends on the account, conversation, participants, timestamps, status indicators and surrounding context.

Record the service, account, username, phone number, profile or handle shown.

Capture the conversation title, participant list, group name, administrator roles and any visible invitation or membership information.

Preserve the full screen before closer detail. Record message order, dates, times, time zone, sender labels, delivery status, read status, reactions, edits and deletion markers.

Note whether messages are incoming, outgoing, pending, failed, disappearing, encrypted or linked to another device.

Capture visible attachments, links, filenames, previews and provider-generated identifiers without opening them unnecessarily.

Record any typing indicator, online status, call status, pinned message, draft or unsent content.

Do not scroll, refresh, open profiles or expand messages merely to make the record more complete. Those actions may create new activity or change the state.

If scrolling is necessary, record the original visible position and each movement so the sequence can be reconstructed.

Distinguish what was visible at first observation from anything that arrived or changed later.

Where the conversation is central, volatile or connected to serious harm, obtain specialist or provider support before extensive interaction.

Record whether the conversation is a direct message, group, channel, broadcast or archived thread, because that affects who may control or receive later content.

Operational takeaway¶

Preserve the account, participants, message state, timestamps and visible conversation context before navigating, opening attachments or allowing further synchronisation.